Deletion request audit trail

Severity: Recommended

You need records of deletion requests for compliance inquiries and to prove you processed them.

Check automatically:

# Look for deletion logging/audit
grep -riE "deletion.*log|audit.*delet|log.*erasure|deletion.*record|gdpr.*log" src/ app/ lib/ --include="*.ts" --include="*.js" --include="*.py"

# Check for audit tables or models
grep -riE "deletion_request|erasure_request|gdpr_request|audit_log" src/ app/ models/ migrations/ --include="*.ts" --include="*.js" --include="*.sql"

# Look for admin views of deletion history
grep -riE "deletion.*history|request.*log|audit.*trail" src/ app/ --include="*.ts" --include="*.js"

Ask user:

• "Do you track deletion requests? (who requested, when, what was deleted)"
• "Where is this audit trail stored?"
• "How long do you retain deletion audit records?"

Pass criteria:

• Deletion requests logged (requester, date, what was deleted, who processed)
• Audit trail accessible for compliance inquiries
• Retention period defined for audit records

Fail criteria:

• No record of past deletions
• Deletions happen but aren't tracked
• "We'd have to check server logs"

Evidence to capture:

• Audit mechanism (database table, log system, ticket system)
• Fields captured (requester, date, scope, processor)
• Retention period for audit records

---